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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 



Listing of Claims: 

1-8 (Canceled) 

1 9. (Previously presented) A computer-implemented method for ensuring 

2 non-repudiation of a payment request , the payment request being generated in a computing 

3 environment having a connection to a network , the method comprising the stops of : 

4 receiving, at one or more computer systems operated by an organization over the 

5 network , [[the]] a payment request identifying at least at least one payee; 

6 receiving together with , at the one or more computer systems operated by an 

7 organization, a certificate identifying a user having caused the payment request to bo generated, 

8 th e c e rtificat e including certificate-identifying information^ [[and]] user-identifying information 

9 identifying a user having caused the payment request to be generated , the certificate further 

1 0 including and authority information defining; 

11 an authority of the user identified in the user-identifying information to 

12 make [[the]] payment requests, 

1 3 the authority information including a maximum payment that the user 

14 identified in the user-identifying information is authorized to make.^ and 

1 5 an identification of a list of specific payees to whom the user identified in 

1 6 the user-identifying information is authorized to make payments; 

17 validating the certificate identifying information and the user identifying 

18 information included within the received certificate; 

19 accessing a store of authority information that is coupled to the network, that is 

20 stored apart from the payment request and that is independent of the received certificate; 

21 retrieving, with one or more processors associated with the one or more computer 

22 systems operated by an organization, from the accessed store of authority information, stored 
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23 authority information that is associated with the user identified in the user-identifying 

24 information from a store of authority information hosted outside the organization and that is 

25 independent of the received certificate ; 

26 comparing the retrieved authority information with the authority information 

27 included within the received certificate to determine whether the retrieved authority information 

28 matches the authority information included within the received certificate; 

29 validating , with the one or more processors associated with the one or more 

30 computer systems operated by an organization, the authority information within the received 

3 1 certificate only if the based on a comparison between the retrieved authority information matches 

32 and the authority information included within the received certificate^,]]; and 

33 executing of generating information, with the one or more processors associated 

34 with the one or more computer systems operated by an organization, authorizing the payment 

3 5 request only when the certificate - identifying information, the usor - idontifying information and in 

36 response to a validation of the authority information included within the received certificate 

37 when the at least one payee identified in the payment request is included in the list of specific 

38 payee defined in the authority information included within the received certificate is successfully 

1 10. (Currently amended) The method of claim 9, wherein the payment request 

2 is for a predetermined amount and wherein authorizing the payment request further comprises is 

3 authorized only when the validating steps are successful and when the authority information for 

4 the user stored in the hierarchical authority data structure lists an authorized amount for the user 

5 authorizing the payment request when the maximum payment that the user identified in the user- 

6 identifying information is authorized to make is at least greater than or equal to the 

7 predetermined amount. 

1 11. (Currently amended) The method of claim 9, wherein the received 

2 certificate received in the receiving step conforms to the X.509 standard. 
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1 12. (Currently amended) The method of claim 9, wherein the authority 

2 information included in the received certificate is configured as XML code. 

1 13. (Original) The method of claim 9, wherein the XML code is compliant 

2 with a DSML standard. 

14. (Canceled) 

1 15. (Currently amended) A non-transitory computer-readable storage medium 

2 configured to store storing computer-executable code for one or more software application 

3 configured to carrying out a financial transaction , the application being configured to run on a 

4 computer coupled to a network , the computer-readable storage medium comprising: 

5 certificate receiving code which is configured to receive a digital certificate &ei» 

6 a us e r ov e r th e n e twork, th e c e rtificate including certificate-identifying information [[and]] user- 

7 identifying information identifying a user responsible for the financial transaction , th e c e rtificat e 

8 further including and authority information that defines defining: 

9 an authority granted to of the user to request that the financial transaction 

10 be carried out, 

1 1 the authority information including a maximum transaction amount 

12 payment that the user identified in the user-identifying information is authorized to make^ and 

1 3 an identification payees to a list of specific parties with whom the user 

14 identified in the user-identifying information is authorized to carry out transactions make 

15 payments ; 

16 certificate validating code configured to enable validation of the certificate 

17 identifying information and user - identifying information within the received certificate, and 

1 8 authorization validating code configured to cause the computer to carry out stops 

19 of: accessing a store of authority information that is coupled to the network, that is stored apart 

20 from the payment request and that is independent of the received certificate; retrieve ing, from the 

2 1 accessed data structure, stored authority information that is associated with the user identified in 
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22 the user-identifying information from a store of authority information stored apart from the 

23 payment request and that is independent of the received digital certificate and ; comparing the 

24 retrieved authority information with the authority information included within the received 

25 certificate to determine whether the retrieved authority information matches the authority 

26 information included within the received certificate; validate[[ing]] the authority information 

27 within the received digital certificate only if the based on a comparison between the retrieved 

28 authority information matches and the authority information included within the received digital 

29 certificate!!,]]; and 

30 code for generating information authorizing executing of the financial transaction 

3 1 only when in response to a validation of the authority information included within the received 

32 digital certificate when at least one party to the transaction is included in the list of specific 

33 parties defined in the authority information included within the received digital certificate is 

34 successfully validated . 

1 16. (Previously presented) The computer-readable storage medium of claim 

2 15, wherein the digital certificate conforms to the X.509 standard. 

1 17. (Currently amended) The computer-readable storage medium of claim 15, 

2 wherein the authority information included in the received digital certificate is configured as 

3 XML code. 

1 18. (Previously presented) The computer-readable storage medium of claim 

2 17, wherein the XML code is compliant with a DSML standard. 

1 19. (Currently amended) The computer-readable storage medium of claim 15, 

2 wherein the authority defined [[by]] in the authority information within the received digital 

3 certificate also defines rights of the user to access predetermined data and programs associated 

4 with the financial transaction within the network . 



20-28 (Canceled) 
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1 29. (Currently amended) A server computer to authenticate a user of a client 

2 computer and to verify that the user is authorized to request that the server computer carry out a 

3 requested action, the server computer comprising: 

4 a processor; and 

5 a memory coupled to the processor and configured to store a set of instructions 

6 that when executed by the processor causes the processor to: 

7 receive a payment request along with a digital certificate assigned to the 

8 user of the client computer, the digital certificate comprising a first code portion and a second 

9 code portion, 

10 wherein the first code portion of the digital certificate is configured 

1 1 to enable authentication of the user, the first code portion defining[[es]] a public key, a certificate 

12 serial number, a certificate validity period, a digital signature of the certificate authority, and an 

13 extension field, 

14 wherein the second code portion of the digital certificate is 



15 configured to define an authority of the user of the client computer to request that the server 

16 computer carry out the requested action, the second code portion being configured for inclusion 

17 within the extension field of the first code portion, the authority of the user defined within the 

1 8 second code portion of the certificate defining access rights of the user including a maximum 

1 9 payment that the user is authorized to make and an identification of a list of specific payees to 

20 whom the user is authorized to make payments; 



21 access a store of authority information that is coupled to the network, that 

22 is stored independent of the received digital certificate; 

23 retrieve, from the accessed a store of authority information, stored 

24 authority information that is associated with the user of the client computer that is stored apart 

25 from the payment request and that is independent of the received digital certificate ; 

26 compare the retrieved authority information with the authority information 

27 included within the digital cortificato to determine whether the retrieved authority information 

28 matches the authority information included within the digital certificate; 
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29 validate the authority information within the digital certificate only if the 

30 based on a comparison between the retrieved authority information matches and the authority 

3 1 information included within the digital certificate^,]]; and 

32 generate information authorizing the payment request carry out the 

33 requested action only when in response to a validation of the authority information within the 

34 digital certificate when the at least one payee identified in the payment request is included in the 

35 list of specific payee defined in the authority information included within the received certificate 

36 is successfully validated . 

1 30. (Previously presented) The server computer of claim 29, wherein the 

2 digital certificate conforms to the X.509 standard. 

1 31. (Previously presented) The server computer of claim 2.9, wherein the 

2 second code portion is configured as XML code. 

1 32. (Previously presented) The server computer of claim 3 1 , wherein the 

2 XML code is compliant with a DSML standard. 

1 33. (Previously presented) The server computer of claim 29, wherein the 

2 authority of the user of the client computer is stored in a hierarchical authority data structure that 

3 is accessible by the server computer. 
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